Read the docs
TI-2026-84447 Aliases CVE-2026-121624GHSA-9f32-gwgg-fqrv

Nanosystems Supremo improper TLS certificate validation

Priority LOW 34CWE-295Published · Updated

Key facts

Attack vector
Adjacent network
Privileges required
None
User interaction
None
Attack complexity
High
Attack requirements
Present
Impact type
Spoofing
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-295.

Summary

Nanosystems Supremo for Windows and macOS before 5.0.2.3874 has improper TLS certificate validation (CWE-295). An adjacent attacker on the same network can present untrusted certificates to intercept TLS connections, terminate and relay the client's session with self-signed certificates, and read usernames, SHA-256 password hashes and license codes.

Written with Claude Haiku 5.5 from the sources below · 2026-11-03

Description from the CNA

Nanosystems Supremo for Windows and macOS before 5.0.2.3874 contains an improper certificate validation vulnerability that allows adjacent attackers to intercept TLS connections by presenting untrusted certificates. Attackers on the same network can terminate and relay the client's TLS session using self-signed certificates to read usernames, SHA-256 password hashes, and license codes.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00132 2nd percentileScored 2026-11-07
Fix Fixed Supremo (Nanosystems): 5.0.2.3874

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
NanosystemsSupremobefore 5.0.2.38745.0.2.3874Patch availableCNA
  • Supremo VendorNanosystems Affected before 5.0.2.3874 Fixed in 5.0.2.3874 Patch available CNA

Remediation

Update Nanosystems Supremo to version 5.0.2.3874 or later.

Written with Claude Haiku 5.5 from the sources below · 2026-11-03

  • Fix · CNA Supremo (Nanosystems) Fixed in 5.0.2.3874

Timeline

  1. 2026-11-03 Threatist record created from CVE-2026-121624
  2. 2026-11-03 Alias added: GHSA-9f32-gwgg-fqrv
  3. 2026-11-03 CISA SSVC decision points changed
  4. 2026-11-03 Priority changed: MEDIUM → LOW

References

Other 3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences